Repository navigation
fix(deps): update compress for CVE-2026-116591 (5.0) - #23826
dashrews78 wants to merge 1 commit into
Conversation
Backport the v1.20.3 dependency update already merged in #23464. This includes the upstream zstd two-block panic fix without application changes. User request: "Create all the necessary PRs in stackrox and scanner." This change was partially generated by AI.
|
Skipping CI for Draft Pull Request. |
🚀 Build Images ReadyImages are ready for commit 592a9d1. To use with deploy scripts: export MAIN_IMAGE_TAG=5.0.0-rc.5-1-g592a9d15d4 |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## release-5.0 #23826 +/- ##
===============================================
- Coverage 51.93% 51.89% -0.05%
===============================================
Files 2905 2905
Lines 182946 182946
===============================================
- Hits 95017 94941 -76
- Misses 79628 79683 +55
- Partials 8301 8322 +21
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
/konflux-retest scanner-v4-on-push |
|
/konflux-retest operator-on-push |
|
/konflux-retest roxctl-on-push |
|
/konflux-retest scanner-v4-on-push |
|
/konflux-retest operator-on-push |
|
/konflux-retest roxctl-on-push |
|
/konflux-retest scanner-v4-on-push |
|
/konflux-retest operator-on-push |
|
/konflux-retest roxctl-on-push |
|
/konflux-retest operator-bundle-on-push |
2 similar comments
|
/konflux-retest operator-bundle-on-push |
|
/konflux-retest operator-bundle-on-push |
|
/konflux-retest operator-index-on-push |
1 similar comment
|
/konflux-retest operator-index-on-push |
|
/konflux-retest create-custom-snapshot |
|
/konflux-retest operator-index-on-push |
|
/konflux-retest create-custom-snapshot |
1 similar comment
|
/konflux-retest create-custom-snapshot |
|
/retest |
1 similar comment
|
/retest |
CI failure triage (2026-11-03)None of the current failures are caused by the compress bump. GHA e2e failures (gke-upgrade-tests ×3, db-backup-restore, nongroovy)All five jobs die in the "Verify kubectl access and wait for cluster to stabilize" step, before deploying anything: Known issue: google-github-actions/auth#535 —
Once #23792 merges, these jobs should go green on re-run. No action needed here. Konflux acs-conforma-dev-5-0 failures
TL;DR: re-run e2e after #23792 lands; conforma failures are branch-wide noise. |
Description
Backport the compress v1.20.3 update from #23464 to release-5.0 to include the CVE-2026-116591 zstd decoder fix. Updating the shared root dependency covers the binaries built from this module; legacy Scanner is updated separately in stackrox/scanner.
User-facing documentation
Testing and quality
Automated testing
How I validated my change
go list -m github.com/klauspost/compress: v1.20.3.TestDecoderHuffWeightsTableLogpasses (covers the CVE input in DecodeAll and streaming modes).git diff --checkpasses.make stylewas attempted but local validation is incomplete; CI review remains pending.Dependency-only change; existing regression and application tests were reused.